How Ghimob attacks, the new banking virus that captures mobile phones

A new computer virus (malware) called bank Ghimob which attracts victims to install malicious file via an email stating that they have debts.

The cybersecurity company Kaspersky warned this Friday against the banking malware Ghimob, the latest creation of the Guildma Trojan family, known for its malicious activities in Latin America and other parts of the world.

Ghimob urges victims to settle down a malicious file via email stating that you are in debt and providing a link where they can get more information.

Once the Remote Access Trojan (RAT) is installed, the malware sends a notification infection to your server and includes device model, a list of installed applications and whether you have activated the screen lock.

Even if the victims have a screen lock pattern, the malware is capable of record and play then to unlock the device.

This banking virus can spy on up to 153 mobile apps, the majority of which are from banks, fintechs, investment apps, and cryptocurrencies.

Once the infection is carried out, the cybercriminal can access the device remotely and terminate the fraud using the victim’s phone, avoiding automatic identification and security measures implemented by financial institutions.

While executing the transaction, the cybercriminal superimposes a black screen or a web page that takes up the entire screen, so that the victim does not see the movements made in the background.

Ghimob primarily targets users in Brazil, although it also targets Paraguay, Peru, Portugal, Germany, Angola and Mozambique, according to Kaspersky statistics.